CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 21/04/2022 |
| CVE-2022-27924KEV | 高7.5 | Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries. | 21/04/2022 |
| CVE-2022-24682KEV | 中6.1 | An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to b | 09/02/2022 |
| CVE-2020-18985 | 中6.1 | An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing. | 15/12/2021 |
| CVE-2020-18984 | 中6.1 | A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection. | 15/12/2021 |
| CVE-2020-13653 | 中6.1 | An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScript into the account name of a user's profile. The injected code can be reflected and executed when changing an e-mail signature. | 02/07/2020 |
| CVE-2020-12846 | 高8.0 | Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files (exe,sh,bat,jar) in the Contact section of the mailbox as an avatar image for a contact. A user wil | 03/06/2020 |
| CVE-2020-8633 | 中5.3 | An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7. When grantors revoked a shared calendar in Outlook, the calendar stayed mounted and accessible. | 18/02/2020 |
| CVE-2020-7796KEV | 緊急9.8 | Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled. | 18/02/2020 |
| CVE-2019-11318 | 中5.4 | Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS. | 27/01/2020 |
| CVE-2015-2249 | 中5.4 | Zimbra Collaboration before 8.6.0 patch5 has XSS. | 27/01/2020 |
| CVE-2014-8563 | 緊急9.8 | Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS. | 27/01/2020 |
| CVE-2014-5500 | 中6.1 | Synacor Zimbra Collaboration before 8.0.8 has XSS. | 27/01/2020 |
| CVE-2015-7609 | 中6.1 | Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra. | 30/05/2019 |
| CVE-2015-2230 | 中6.1 | Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console. | 30/05/2019 |
| CVE-2018-14425 | 中6.1 | There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before 8.8.9 Patch 1. | 30/05/2019 |
| CVE-2018-10948 | 中4.8 | Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs. | 30/05/2019 |
| CVE-2018-15131 | 中5.3 | An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests. | 30/05/2019 |